CVE-2026-109678
Received Received - Intake

Remote Assertion Failure in FreeRDP via Malicious SCardStatusA Request

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulnCheck

Description
FreeRDP 3.0.0-beta1 before 3.32.0, when built with verbose WinPR assertions and using smartcard emulation, has a reachable assertion: the emulated SCardStatusA passes a NULL reader-name destination to scard_copy_strings. A malicious RDP server can send an SCardStatusA request with fmszReaderNamesIsNULL=1 to abort a connecting client.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-109678
EUVD
EUVD-2026-98700

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FreeRDP FreeRDP 3.0.0-beta1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-617 The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a reachable assertion vulnerability in FreeRDP versions 3.0.0 through 3.31.1 when built with verbose WinPR assertions and smartcard emulation enabled. A malicious RDP server can send a crafted SCardStatusA request with fmszReaderNamesIsNULL=1, causing FreeRDP to pass a NULL reader-name to scard_copy_strings and trigger an assertion failure. This crashes the client process without credential disclosure or code execution.

Detection Guidance

To detect this vulnerability, check if FreeRDP is running with smartcard emulation enabled and verbose WinPR assertions compiled. Use commands like 'ps aux | grep freerdp' to inspect running FreeRDP processes. Verify FreeRDP version with 'xfreerdp --version' or 'freerdp2 --version' to confirm if it is between 3.0.0-beta1 and 3.31.1.

Impact Analysis

The impact is limited to denial of service. An attacker controlling an RDP server can terminate FreeRDP clients using smartcard emulation, causing unexpected crashes. No sensitive data is exposed, and no remote code execution is possible. The attack requires the client to be built with verbose assertions enabled.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR, HIPAA, or similar regulations as it does not result in data breaches or unauthorized access. However, repeated denial-of-service incidents could affect service availability, which may indirectly impact compliance with availability requirements in some contexts.

Mitigation Strategies

Immediately update FreeRDP to version 3.32.0 or later. If updating is not possible, disable smartcard emulation in FreeRDP client configurations. Ensure verbose WinPR assertions are disabled by recompiling FreeRDP without WITH_VERBOSE_WINPR_ASSERT=ON.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109678. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart